Troubleshooting Guide

Transcription

1 IBM Security Access Manager for Mobile Version 8 Release 0 Troubleshooting Guide GC

2

3 IBM Security Access Manager for Mobile Version 8 Release 0 Troubleshooting Guide GC

4 Note Before using this information and the product it supports, read the information in Notices on page 47. Edition notice Note: This edition applies to version 8.0 of IBM Security Access Manager for Mobile (product number 5725-L52) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Figures v Tables vii About this publication ix Access to publications and terminology..... ix Accessibility x Technical training x Support information x Statement of Good Security Practices x Part 1. Introduction to troubleshooting Chapter 1. Getting started with troubleshooting Chapter 2. Diagnosing problems with diagnostic tools Messages Message format Message identifiers Logs Using the Messages Guide to resolve errors Part 2. Appliance troubleshooting.. 7 Chapter 3. Running self-diagnostic tests (hardware appliance only) Chapter 4. Known issues and solutions 11 Chapter 5. Known limitations Part 3. Using log files Chapter 6. Viewing the event log Chapter 7. Viewing memory statistics 21 Chapter 8. Viewing CPU utilization Chapter 9. Viewing storage utilization 25 Chapter 10. Viewing application log files Chapter 11. Viewing application interface statistics Chapter 12. Tuning runtime application parameters and tracing specifications. 31 Deploying pending changes Part 4. Appendixes Appendix. Support Information Techniques for troubleshooting problems Searching knowledge bases Getting fixes Getting fixes from Fix Central Contacting IBM Support Exchanging information with IBM Sending information to IBM Support Receiving information from IBM Support Subscribing to Support updates Notices Index Copyright IBM Corp iii

6 iv IBM Security Access Manager for Mobile: Troubleshooting Guide

7 Figures Copyright IBM Corp v

8 vi IBM Security Access Manager for Mobile: Troubleshooting Guide

9 Tables 1. Product identifiers that are used by IBM Security Access Manager for Mobile Copyright IBM Corp vii

10 viii IBM Security Access Manager for Mobile: Troubleshooting Guide

11 About this publication The IBM Security Access Manager for Mobile Troubleshooting Guide provides a comprehensive set of procedures and reference information for troubleshooting Security Access Manager for Mobile. Access to publications and terminology This section provides: v A list of publications in the IBM Security Access Manager for Mobile library. v Links to Online publications. v A link to the IBM Terminology website. IBM Security Access Manager for Mobile library The following documents are available online in the IBM Security Access Manager for Mobile library: v IBM Security Access Manager for Mobile Configuration Guide, SC v IBM Security Access Manager for Mobile Administration Guide, SC v IBM Security Access Manager Appliance Administration Guide, SC v IBM Security Access Manager for Mobile Auditing Guide, SC v IBM Security Access Manager for Mobile Troubleshooting Guide, GC v IBM Security Access Manager for Mobile Error Message Reference, GC Online publications IBM posts product publications when the product is released and when the publications are updated at the following locations: IBM Security IBM Security Access Manager for Mobile library The product documentation site ( tivihelp/v2r1/topic/com.ibm.ammob.doc_8.0.0/welcome.html) displays the welcome page and navigation for the library. IBM Security Systems Documentation Central IBM Security Systems Documentation Central provides an alphabetical list of all IBM Security Systems product libraries and links to the online documentation for specific versions of each product. IBM Publications Center The IBM Publications Center site ( linkweb/publications/servlet/pbi.wss) offers customized search functions to help you find all the IBM publications you need. IBM Terminology website The IBM Terminology website consolidates terminology for product libraries in one location. You can access the Terminology website at software/globalization/terminology. Copyright IBM Corp ix

12 Accessibility Technical training Support information Accessibility features help users with a physical disability, such as restricted mobility or limited vision, to use software products successfully. You can use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see the IBM Accessibility website at For technical training information, see the following IBM Education website at IBM Support provides assistance with code-related problems and routine, short duration installation or usage questions. You can directly access the IBM Software Support site at IBM Security Access Manager for Mobile Troubleshooting Guide provides details about: v What information to collect before contacting IBM Support. v The various methods for contacting IBM Support. v How to use IBM Support Assistant. v Instructions and problem-determination resources to isolate and fix the problem yourself. Note: The Community and Support tab on the product information center can provide additional support resources. Statement of Good Security Practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. x IBM Security Access Manager for Mobile: Troubleshooting Guide

13 Part 1. Introduction to troubleshooting Copyright IBM Corp

14 2 IBM Security Access Manager for Mobile: Troubleshooting Guide

15 Chapter 1. Getting started with troubleshooting Problem determination, or troubleshooting, is a process of determining why a product is not functioning in the expected manner. This guide provides information to help you identify and resolve problems with IBM Security Access Manager for Mobile and its prerequisite products. The troubleshooting process, in general, requires that you isolate and identify a problem, then seek a resolution. You can use a troubleshooting checklist to help you. If the checklist does not lead you to a resolution, you can collect additional diagnostic data and analyze it yourself. You can also submit the data to IBM Software Support for analysis. Copyright IBM Corp

16 4 IBM Security Access Manager for Mobile: Troubleshooting Guide

17 Chapter 2. Diagnosing problems with diagnostic tools When problems do occur, use the information about diagnostic tools to learn how to identify and possibly resolve them. If you are unable to correct the problem, gather the relevant diagnostic information and then contact IBM Support to get further assistance. v Messages v Logs on page 6 v Using the Messages Guide to resolve errors on page 6 Messages All messages issued by IBM Security Access Manager for Mobile adhere to a Message Standard. The Message Standard specifies a standard format for all messages issued by this product. The standard, based on the IBM Message Standard, is intended to provide a consistent and meaningful way for identifying messages across the entire IBM product set. Messages issued by IBM Security Access Manager for Mobile, along with detailed explanations and suggested actions, can be found in the IBM Security Access Manager for Mobile: Error Message Reference. Message format A message consists of a message identifier (ID) and message text and an error code. The error code is a unique 32-bit value. The error code is either a decimal or hexadecimal number and indicates that an operation was not successful. All messages that follow the message standard are listed in the IBM Security Access Manager for Mobile Error Message Reference. Each of these messages has a detailed explanation and suggested actions. Message identifiers A message ID consists of 10 alphanumeric characters that uniquely identify the message. The message ID consists of the following parts: v A 3-character product identifier (see Table 1 for the list of identifiers that are used by IBM Security Access Manager for Mobile) v A 2-character component or subsystem identifier v A 4-digit serial or message number v A 1-character type code that indicated one of the following message severities: W Warning E Error I Information Table 1. Product identifiers that are used by IBM Security Access Manager for Mobile Product identifier IBM Security Access Manager for Mobile component DPW Secure Reverse Proxy Copyright IBM Corp

18 Table 1. Product identifiers that are used by IBM Security Access Manager for Mobile (continued) Product identifier IBM Security Access Manager for Mobile component CTG Authorization Service FBT Protocol Service Logs Use log files to retrieve information about a problem in your environment. Enable the collection of detailed log and trace information to troubleshoot problems. You can collect and review standard informational log messages or detailed trace messages to help determine the root cause of a problem. For more information about using logs, see Chapter 6, Viewing the event log, on page 19. Using the Messages Guide to resolve errors Use the unique message ID associated with a message to locate detailed explanations and suggested operator responses in the guide. The IBM Security Access Manager for Mobile Error Message Reference contains a list of messages in the IBM Security Access Manager logs, graphical user interfaces, and the command line. For example, if you see the following error message in the message log: CTGSI0311E The distributed session cache server was unable to generate a new key. Search for CTGSI0311E in the guide for information about why the error occurred and how to resolve it. For example, the previous error message has the following information in the IBM Security Access Manager for Mobile Error Message Reference: Explanation: The distributed session cache server was unable to generate a new key. Administrator response: Examine the distributed session cache server logs for further details. It may be necessary to restart the distributed session cache server completely to correct this condition. 6 IBM Security Access Manager for Mobile: Troubleshooting Guide

19 Part 2. Appliance troubleshooting Copyright IBM Corp

20 8 IBM Security Access Manager for Mobile: Troubleshooting Guide

21 Chapter 3. Running self-diagnostic tests (hardware appliance only) The hardware appliance provides a self-diagnostic program to assist with troubleshooting. This feature is not available with the virtual appliance. Procedure 1. Reboot the appliance. 2. From the console, select the Hardware Diagnostics option from the GNU GRUB menu. The diagnostics program starts running after this option is selected. After the appliance finishes booting, the diagnostics program is accessible from the console. 3. To run a diagnostic test, enter phdiag <test_name>, where <test_name> is one of the following values in bold: all lcd system Run all standard tests (No storage bad blocks test, default) Run LCD tests Run standard system tests (MTM-Serial, Inventory, PSU, FAN, SEL) network Run network port tests (Selftest, Traffic) storage Run storage tests (SMART, FSCK) badblocks Run storage bad blocks test Copyright IBM Corp

22 10 IBM Security Access Manager for Mobile: Troubleshooting Guide

23 Chapter 4. Known issues and solutions Use the solutions to troubleshoot issues that you might encounter when you are using IBM Security Access Manager for Mobile. Enabling Compatibility View in Internet Explorer 9 returns the Browser not Supported message The IBM Security Access Manager appliance does not support the browser operating in this mode. The following message is displayed in the local management interface: Browser not Supported. The IBM Security Access Manager appliance does not support this browser. The following browsers are currently supported: - Internet Explorer 9 or later - Firefox 17.0 or later - Google Chrome 27.0 or later Solution: The appliance does not support Internet Explorer if the Compatibility View is turned on. Ensure that the Compatibility View in Internet Explorer is turned off. The Compatibility View option is under the Tools menu in the Internet Explorer browser. Help page content does not display When you click the Help link from the appliance user interface while using Microsoft Internet Explorer version 9.0 or later, the topic content might not display. Solution: Ensure that the Compatibility View in Internet Explorer is turned on. The Compatibility View option is under the Tools menu in the Internet Explorer browser. The Help System supports compatibility mode. WebSEAL sends client certificate by default The isamcfg tool can configure a WebSEAL or Web Reverse Proxy instance to use client certificate authentication to the IBM Security Access Manager for Mobile runtime. The runtime can be configured to optionally accept client certificates. When configured in this mode, WebSEAL or the Web Reverse Proxy sends a client certificate regardless of whether a certificate label is specified in the configuration. Solution: If you require client certificate authentication, ensure that a valid client certificate is specified in the ssl-keyfile-label entry of the [rtss-cluser:<cluster name>] stanza. If you do not require client certificate authentication, either disable the optional acceptance of client certificates in IBM Security Access Manager for Mobile or specify an invalid client certificate label in the ssl-keyfile-label entry Copyright IBM Corp

24 of the [rtss-cluser:<cluster name>] stanza. This method ensures that WebSEAL does not send a client certificate. A junction error occurs when a duplicate dn or certificate label is detected The isamcfg tool imports the IBM Security Access Manager for Mobile server certificate to the WebSEAL or Web Reverse Proxy keystore when it uses an SSL connection. If an entry exists in this keystore with the same dn or the same certificate label, an error can occur when it creates the junction to IBM Security Access Manager for Mobile. Solution: You must manually export the certificate that is presented by the IBM Security Access Manager for Mobile runtime and import it to the WebSEAL key database as a signer certificate. The junction then becomes accessible. Web Gateway Appliance fails to connect to the authorization service endpoint When IBM Security Access Manager for Mobile Appliance is configured in FIPS and NIST SP A compliant mode, the RBA EAS configured in the POC Web Gateway Appliance fails to connect to the authorization service endpoint, causing the RBA flow to fail. This issue also affects the ping call that is issued regularly. The connection failed because the authorization service EAS uses SSLv2, which is not supported by the IBM Security Access Manager for Mobile Appliance when it operates in the NIST SP A strict compliant mode. Solution: 1. In the IBM Security Access Manager for Mobile Appliance local management interface, select Reverse Proxy Settings > <your instance> > Manage > Configuration > Edit configuration file. The Advanced Configuration File Editor opens. 2. Add the parameter to the existing stanza. [rtss-cluster:cluster1] gsk-attr-name = enum:438:1 3. Click Save. 4. Deploy the changes. 5. Restart the instance. On Windows operating systems, you cannot use basic authentication for WebSEAL from IBM Security Access Manager for Web WebSEAL does not start properly if your configuration meets all of these conditions: v Windows operating system v WebSEAL from IBM Security Access Manager for Web v Basic authentication configured in the WebSEAL configuration file with basic-auth-user and basic-auth-passwd entries in the [rtss-cluster:cluster1] stanza Solution: 12 IBM Security Access Manager for Mobile: Troubleshooting Guide

25 To work around this issue, configure certificate authentication for WebSEAL. See the WebSEAL administration information in the information center at webseal.html. If you are using the isamcfg tool to configure WebSEAL, be sure to select certificate authentication for the authentication method response. Incorrectly formatted FORM or JSON data in custom attributes causes policy failure If a policy contains a custom attribute that has incorrectly specified FORM or JSON data, the policy will fail and the user will not be permitted to access the resource. Specifically, all of the following conditions apply: v v v The WebSEAL configuration file contains a post-data entry in the [azn-decision-info] stanza. The <post-data-name> value found for the post-data entry is not formatted properly. For example, the date format is not correct. The.datatype entry specified in the [user-attribute-definitions] stanza for this azn-decision-info attribute is a type other than string. Solution: Ensure that you specify the correct format for the data. For example: v Valid date format is: yyyy-mm-ddzzzzzz For example: :00 v Valid time format is: hh:mm:sszzzzzz For example: 13:12:36-06:00 Database rolls back with an error when you attempt to remove a large quantity of records from a DB2 runtime database When you try to delete many device fingerprints or user session data records from an external DB2 runtime database, the following error might occur: Error occurred. The database was rolled back to the previous version. The transaction log for the database is full. SQLCODE=-964, SQLSTATE=57011 Solution: Increase the log capacity by completing the following actions: v Increase the number of primary and secondary transaction log files. v Increase the size of each transaction log. For information about the available transaction log configuration parameters, see the DB2 documentation. A cluster configuration update fails to deploy and generates a timeout error message An update to the cluster configuration, such as the External Reference Entity IP address or First Port value, might fail to deploy in the allotted time. The following error message is printed in the event log: WGASY0007E The pending changes failed to deploy within the allotted time. Chapter 4. Known issues and solutions 13

26 Solution: Increase the wga.cmd.timeout value. In the local management interface, select Manage System Settings > System Settings > Advanced Tuning Parameters. Add a parameter that is called wga.cmd.timeout and set the timeout value in seconds. The default value is 300 seconds. The ISAM for Mobile cookies are not removed when a user logs out by using non-standard junction name or cookie names The ISAM for Mobile runtime sets cookies for attribute collection purposes. The isamcfg tool configures a WebSEAL or Web Reverse Proxy configuration option to clean these cookies upon session termination. It uses the ISAM for Mobile advanced configuration to determine which cookie values to clear. Solution: When the junction name attributecollection.servicelocation or cookie name attributecollection.cookiename in the ISAM for Mobile advanced configuration changes, you must run the isamcfg tool so that these changes are picked up. 14 IBM Security Access Manager for Mobile: Troubleshooting Guide

27 Chapter 5. Known limitations Consider these known limitations when you are configuring the IBM Security Access Manager for Mobile 8.0 environment. External clients cannot use the session cache. The distributed session cache in the IBM Security Access Manager for Mobile version 8.0 appliance does not support external clients. The Support internal and external clients option on the Session Cache tab on the Cluster Configuration management page is not relevant in an IBM Security Access Manager for Mobile 8.0 environment. The IBM Security Access Manager for Mobile 8.0 appliance disregards the Port, Keyfile, and Label fields, which relate to external clients. Local management interface (LMI) session timeouts. LMI sessions expire after the duration of time that is specified by the Session Timeout field on the Administrator Settings page. When a session timeout occurs, you are automatically logged out and any unsaved data on the current page is lost. Save your configuration updates in the LMI regularly to avoid data loss in the event of a session timeout. Copyright IBM Corp

28 16 IBM Security Access Manager for Mobile: Troubleshooting Guide

29 Part 3. Using log files Copyright IBM Corp

30 18 IBM Security Access Manager for Mobile: Troubleshooting Guide

31 Chapter 6. Viewing the event log System events are logged when the system settings are changed and when problems occur with the system. Use the Event Log management page to view system events. Procedure 1. Click Monitor Analysis and Diagnostics > Logs > Event Log. The system events displayed. 2. Click Pause Live Streaming to stop the live updating of the event log. 3. Click Start Live Streaming to resume live updating of the event log. Copyright IBM Corp

32 20 IBM Security Access Manager for Mobile: Troubleshooting Guide

33 Chapter 7. Viewing memory statistics View the memory graph to see the memory utilization of the IBM Security Access Manager for Mobile. Procedure 1. Click Monitor Analysis and Diagnostics > System Graphs > Memory. 2. Select a Date Range: Option Description 1 Day Displays data points for every minute during the last 24 hours. 3 Days Displays data points for every 5 minutes during the last three days. Each data point is an average of the activity that occurred in that hour. 7 Days Displays data points every 20 minutes during the last seven days. Each data point is an average of the activity that occurred in that hour. 30 Days Displays data points for every hour during the last 30 days. Each data point is an average of the activity that occurred in that hour. 3. In the Legend box, select Memory Used to review total memory utilization. Copyright IBM Corp

34 22 IBM Security Access Manager for Mobile: Troubleshooting Guide

35 Chapter 8. Viewing CPU utilization View the CPU graph to see the CPU utilization of the IBM Security Access Manager for Mobile. Procedure 1. Click Monitor Analysis and Diagnostics > System Graphs > CPU. 2. Select a Date Range: Option Description 1 Day Displays data points for every minute during the last 24 hours. 3 Days Displays data points for every 5 minutes during the last three days. Each data point is an average of the activity that occurred in that hour. 7 Days Displays data points every 20 minutes during the last seven days. Each data point is an average of the activity that occurred in that hour. 30 Days Displays data points for every hour during the last 30 days. Each data point is an average of the activity that occurred in that hour. 3. In the Legend box, select the CPU utilization data that you want to review: v User v System v Idle Copyright IBM Corp

36 24 IBM Security Access Manager for Mobile: Troubleshooting Guide

37 Chapter 9. Viewing storage utilization View the storage graph to see the percentage of disk space that is used by the boot and root partitions of the IBM Security Access Manager for Mobile. Procedure 1. Click Monitor Analysis and Diagnostics > System Graphs > Storage. 2. Select a Date Range: Option Description 1 Day Displays data points for every minute during the last 24 hours. 3 Days Displays data points for every 5 minutes during the last three days. Each data point is an average of the activity that occurred in that hour. 7 Days Displays data points every 20 minutes during the last seven days. Each data point is an average of the activity that occurred in that hour. 30 Days Displays data points for every hour during the last 30 days. Each data point is an average of the activity that occurred in that hour. 3. In the Legend box, select which partitions you want to review: Boot Root The boot partition. The base file system, where the system user is root. Copyright IBM Corp

38 26 IBM Security Access Manager for Mobile: Troubleshooting Guide

39 Chapter 10. Viewing application log files Use the Application Log Files management page to view and download log files that are produced by IBM Security Access Manager. Procedure 1. From the top menu, select Monitor Analysis and Diagnostics > Application Log Files. The displayed directories contain the application log files that can be viewed and downloaded: v cluster: Contains logs files for the cluster manager. v management_ui: Contains log files for the management interface. v mga: Contains log files specific to the IBM Security Access Manager for Mobile appliance. It contains subdirectories for different categories of log files, such as auditing, isamcfg, and runtime. 2. Optional: Click Refresh to get the most up-to-date data. 3. You can then view or download the displayed log files. To view the log file a. Select the file of interest. b. Click View. The content of the log file is displayed. By default, the last 100 lines of a log file are displayed if the file is longer than 100 lines. You can define the number of lines to display by entering the number in the Number of lines to view field and then click Reload. Alternatively, you can provide a value in the Starting from line field to define the start of the lines. If the Starting from line field is set, then the Number of lines to view field determines how many lines to view forward from the starting line. If the Starting from line field is not set, then the Number of lines to view field determines how many lines to view from the end of the log file. Note: The maximum size that can be returned is lines. If a size greater than that is specified, then the maximum ( lines) is returned. c. Optional: Click Export to download the log file. To download the log file a. Select the file of interest. b. Click Download to save the file to your local drive. c. Confirm the save operation in the browser window that pops up. Copyright IBM Corp

40 28 IBM Security Access Manager for Mobile: Troubleshooting Guide

41 Chapter 11. Viewing application interface statistics To view the bandwidth and frames that are being used on your application interfaces, use the Application Interface Statistics management page. Procedure 1. From the top menu, select Monitor Analysis and Diagnostics > Network Graphs > Application Interface Statistics. 2. In the Date Range field, select the period to display the statistics for. Option Description 1 Day Displays data for every 20-minute interval in one day. 3 Days Displays data for every 20-minute interval during the last three days. 7 Days Displays data for every 20-minute interval during the last seven days. 30 Days Displays data for every day during the last 30 days. Copyright IBM Corp

42 30 IBM Security Access Manager for Mobile: Troubleshooting Guide

43 Chapter 12. Tuning runtime application parameters and tracing specifications To manually tune selected runtime application parameters and tracing specifications, use the Runtime Parameters management page. Procedure 1. From the top menu, select Secure Mobile Settings > Manage > Runtime Parameters. This page contains three panels: Runtime Status, Runtime Tuning Parameters, and Runtime Tracing. 2. Perform one or more of the following actions to tune your runtime. Note: Certain changes might require a restart of the runtime before they can take effect. View the status of and restart the runtime a. Select the Runtime Status panel. The status of local and clustered runtimes are displayed. v Under Local Runtime Status, you can view the runtime operational status, when it was last started, and whether a restart is outstanding. If the value of the Restart Required field is True, it means that the runtime must be restarted for some changes to take effect. v Under Clustered Runtime Status, all nodes in the cluster are listed. The Master column indicates whether a node is the cluster master. The Runtime Status column indicates whether a node is running or stopped. The Changes Active column indicates whether changes made to the cluster configuration are active on this node. Having a green indicator in this column means that all changes made are already active. Having a yellow indicator in this column means that this node must be restarted before some changes can take effect. b. Depending on which runtime you want to restart, click Restart Local Runtime or Restart All Clustered Runtimes. Modify the maximum or initial heap size These parameters indicate the maximum and initial heap size in megabytes for the runtime Java virtual machine. a. On the Runtime Tuning Parameters panel, select Max Heap Size or Initial Heap Size. b. Click Edit. c. In the Max Heap Size or Initial Heap Size window, enter the heap size value as needed. d. Click OK. Modify whether to suppress sensitive trace Copyright IBM Corp

44 Enabling this parameter prevents sensitive information from being exposed in log and trace files. Examples of such sensitive information include bytes received over a network connection. a. On the Runtime Tuning Parameters panel, select Suppress Sensitive Trace. b. Click Edit. c. In the Suppress Sensitive Trace window, select or clear the check box as needed. d. Click OK. Modify console log level Console log level controls the granularity of messages that go to the console.log file. a. On the Runtime Tuning Parameters panel, select Console Log Level. b. Click Edit. c. In the Console Log Level window, select the new value from the list. d. Click OK. Set whether to accept client certificates This parameter controls whether the server accepts client certificates as a form of authentication. a. On the Runtime Tuning Parameters panel, select Accept Client Certificates. b. Click Edit. c. In the Accept Client Certificates window, select or clear the check box as needed. d. Click OK. Set session invalidation timeout This parameter defines the amount of time a session can remain unused before it is no longer valid. a. On the Runtime Tuning Parameters panel, select Session Invalidation Timeout. b. Click Edit. c. In the Session Invalidation Timeout window, define the value in seconds. d. Click OK. Set session reaper poll interval This parameter defines the wake-up interval in seconds for the process that removes invalid sessions. The minimum value is 30 seconds. If a value less than the minimum is entered, an appropriate value is automatically determined and used. This value overrides the default installation value, which is seconds, based on the session timeout value. Because the default session timeout is 120 minutes, the reaper interval is usually 2-3minutes. a. On the Runtime Tuning Parameters panel, select Session Reaper Poll Interval. b. Click Edit. 32 IBM Security Access Manager for Mobile: Troubleshooting Guide

45 c. In the Session Reaper Poll Interval window, define the value in seconds. d. Click OK. Set the keystore that is used by the runtime server This parameter defines the key database that contains the runtime server's private key. a. On the Runtime Tuning Parameters panel, select Keystore. b. Click Edit. c. In the Keystore window, select the key database from the list. d. Click OK. Set the truststore that is used by the runtime server This parameter defines the key database that contains keys that are trusted by the runtime server a. On the Runtime Tuning Parameters panel, select Truststore. b. Click Edit. c. In the Truststore window, select the key database from the list. d. Click OK. Delete the value of a parameter Use this button to delete the existing value of a parameter. a. Select the parameter to reset the value for. b. Click Delete. The value of the parameter is then changed to Unset. Manage the application interface on which the runtime listens a. On the Runtime Tuning Parameters panel, under Runtime Listening Interfaces, you can add, edit, or delete a listening interface. To add a listening interface 1) Click Add. 2) In the Runtime Listening Interfaces window, select the listening interface from the list. 3) Specify the listening port. 4) Select the SSL check box if security is required. 5) Click OK. To modify a listening interface 1) Select the listening interface to edit. 2) Click Edit. 3) In the Runtime Listening Interfaces window, edit the values as needed. 4) Click OK to save the changes. To delete a listening interface 1) Select the listening interface to delete. 2) Select Delete. 3) Confirm the deletion. Manage tracing specification Chapter 12. Tuning runtime application parameters and tracing specifications 33

46 Deploying pending changes a. Select the Runtime Tracing link from the top of this page. You can also access this panel from the top menu by selecting Monitor Analysis and Diagnostics > Logs > Runtime Tracing. b. Use one of the following ways to edit the trace level of a component. v Select the component name from the Component list. Select the ideal trace level for this component from the Trace Level list. Then, click Add. Repeat this process to modify trace levels for other components if needed. To clear all of the tracing levels, click Clear. To log all events, select ALL as the trace level. Note: This setting increases the amount of data in logs, so use this level when necessary. com.ibm.tscc.rtss.*=all:com.ibm.sec.authz.*=all com.tivoli.am.fim.trustserver.sts.modules.*=all: com.tivoli.am.fim.otp.*=all com.tivoli.am.rba.*=all v Enter the name and value of the trace component in the Trace Specification field. To modify multiple components, separate two strings with a colon (:). Here is an example. com.x.y.*=warning:com.a.b.*=warning:com.ibm.isam.*=info c. Click Save. 3. When you make changes, the appliance displays a message that there are undeployed changes. If you have finished making changes, deploy them. Some configuration and administration changes require an extra deployment step. About this task When you use the graphical user interface on the appliance to specify changes, some configuration and administration tasks take effect immediately. Other tasks require a deployment step to take effect. For these tasks, the appliance gives you a choice of deploying immediately or deploying later. When you must make multiple changes, you can wait until all changes are complete, and then deploy all of them at one time. When a deployment step is required, the user interface presents a message that says that there is an undeployed change. The number of pending changes is displayed in the message, and increments for each change you make. Note: If any of the changes require the runtime server to be restarted, the restart occurs automatically when you select Deploy. The runtime server will then be unavailable for a period of time until the restart completes. Procedure 1. When you finish making configuration changes, select Click here to review the changes or apply them to the system. The Deploy Pending Changes window is displayed. 2. Select one of the following options: 34 IBM Security Access Manager for Mobile: Troubleshooting Guide

47 Option Cancel Roll Back Deploy Description Do not deploy the changes now. Retain the undeployed configuration changes. The appliance user interface returns to the previous panel. Abandon configuration changes. A message is displayed, stating that the pending changes were reverted. The appliance user interface returns to the previous panel. Deploy all configuration changes. When you select Deploy, a system message is displayed, stating that the changes were deployed. If any of the changes require the runtime server to be restarted, the restart occurs automatically when you select Deploy. The runtime server will then be unavailable for a period of time until the restart completes. Chapter 12. Tuning runtime application parameters and tracing specifications 35

48 36 IBM Security Access Manager for Mobile: Troubleshooting Guide

49 Part 4. Appendixes Copyright IBM Corp

50 38 IBM Security Access Manager for Mobile: Troubleshooting Guide

51 Appendix. Support Information To isolate and resolve problems with your IBM products, you can use the troubleshooting and support information. This information contains instructions for using the problem-determination resources that are provided with your IBM products, including IBM Security Access Manager for Mobile. Techniques for troubleshooting problems Troubleshooting is a systematic approach to solving a problem. The goal of troubleshooting is to determine why something does not work as expected and how to resolve the problem. Certain common techniques can help with the task of troubleshooting. The first step in the troubleshooting process is to describe the problem completely. Problem descriptions help you and the IBM technical-support representative know where to start to find the cause of the problem. This step includes asking yourself basic questions: v What are the symptoms of the problem? v Where does the problem occur? v When does the problem occur? v Under which conditions does the problem occur? v Can the problem be reproduced? The answers to these questions typically lead to a good description of the problem, which can then lead you to a problem resolution. What are the symptoms of the problem? When you start to describe a problem, the most obvious question is What is the problem? This question might seem straightforward; however, you can break it down into several more-focused questions that create a more descriptive picture of the problem. These questions can include: v Who, or what, is reporting the problem? v What are the error codes and messages? v How does the system fail? For example, is it a loop, hang, crash, performance degradation, or incorrect result? Where does the problem occur? Determining where the problem originates is not always easy, but it is one of the most important steps in resolving a problem. Many layers of technology can exist between the reporting and failing components. Networks, disks, and drivers are only a few of the components to consider when you are investigating problems. The following questions help you to focus on where the problem occurs to isolate the problem layer: v v Is the problem specific to one platform or operating system, or is it common across multiple platforms or operating systems? Is the current environment and configuration supported? Copyright IBM Corp

52 v v Do all users have the problem? (For multi-site installations.) Do all sites have the problem? If one layer reports the problem, the problem does not necessarily originate in that layer. Part of identifying where a problem originates is understanding the environment in which it exists. Take some time to completely describe the problem environment, including the operating system and version, all corresponding software and versions, and hardware information. Confirm that you are running within an environment that is a supported configuration; many problems can be traced back to incompatible levels of software that are not intended to run together or were not fully tested together. When does the problem occur? Develop a detailed timeline of events that led up to a failure, especially for those cases that are one-time occurrences. You can most easily develop a timeline by working backward: Start at the time an error was reported (as precisely as possible, even down to the millisecond), and work backward through the available logs and information. Typically, you need to look only as far as the first suspicious event that you find in a diagnostic log. To develop a detailed timeline of events, answer these questions: v Does the problem happen only at a certain time of day or night? v How often does the problem happen? v What sequence of events leads up to the time that the problem is reported? v Does the problem happen after an environment change, such as upgrading or installing software or hardware? Responding to these types of questions can give you a frame of reference in which to investigate the problem. Under which conditions does the problem occur? Knowing which systems and applications are running at the time that a problem occurs is an important part of troubleshooting. These questions about your environment can help you to identify the root cause of the problem: v Does the problem always occur when the same task is being completed? v Does a certain sequence of events need to happen for the problem to occur? v Do any other applications fail at the same time? Answering these types of questions can help you explain the environment in which the problem occurs and correlate any dependencies. Remember that just because multiple problems might occur around the same time, the problems are not necessarily related. Can the problem be reproduced? From a troubleshooting standpoint, the ideal problem is one that can be reproduced. Typically, when a problem can be reproduced you have a larger set of tools or procedures at your disposal to help you investigate. Problems that you can reproduce are often easier to debug and solve. However, problems that you can reproduce can have a disadvantage: If the problem is of significant business affect, you do not want it to recur. If possible, 40 IBM Security Access Manager for Mobile: Troubleshooting Guide

53 Searching knowledge bases re-create the problem in a test or development environment, which typically offers you more flexibility and control during your investigation. v Can the problem be re-created on a test system? v Are multiple users or applications that encounter the same type of problem? v Can the problem be re-created by running a single command, a set of commands, or a particular application? You can often find solutions to problems by searching IBM knowledge bases. You can optimize your results by using available resources, support tools, and search methods. About this task You can find useful information by searching the information center for this product. However, sometimes you need to look beyond the information center to answer your questions or resolve problems. Procedure To search knowledge bases for information that you need, use one or more of the following approaches: v Search for content by using the IBM Support Assistant (ISA). ISA is a no-charge software serviceability workbench that helps you answer questions and resolve problems with IBM software products. You can find instructions for downloading and installing ISA on the ISA website. v Find the content that you need by using the IBM Support Portal. The IBM Support Portal is a unified, centralized view of all technical support tools and information for all IBM systems, software, and services. The IBM Support Portal lets you access the IBM electronic support portfolio from one place. You can tailor the pages to focus on the information and resources that you need for problem prevention and faster problem resolution. Familiarize yourself with the IBM Support Portal by viewing the demo videos ( about this tool. These videos introduce you to the IBM Support Portal, explore troubleshooting and other resources, and demonstrate how you can tailor the page by moving, adding, and deleting portlets. v v v Search for content about this product by using one of the following additional technical resources: Security Access Manager for Mobile Support website Search for content by using the IBM masthead search. You can use the IBM masthead search by typing your search string into the Search field at the top of any ibm.com page. Search for content by using any external search engine, such as Google, Yahoo, or Bing. If you use an external search engine, your results are more likely to include information that is outside the ibm.com domain. However, sometimes you can find useful problem-solving information about IBM products in newsgroups, forums, and blogs that are not on ibm.com. Tip: Include IBM and the name of the product in your search if you are looking for information about an IBM product. Appendix. Support Information 41

54 Getting fixes A product fix might be available to resolve your problem. About this task Procedure To find and install fixes: 1. Obtain the tools required to get the fix. 2. Determine which fix you need. 3. Download the fix. Open the download document and follow the link in the Download package section. 4. Apply the fix. Follow the instructions in the Installation Instructions section of the download document. 5. Subscribe to receive weekly notifications about fixes and other IBM Support information. Getting fixes from Fix Central You can use Fix Central to find the fixes for various products, including IBM Security Access Manager for Mobile. With Fix Central, you can search, select, order, and download fixes for your system with a choice of delivery options. A IBM Security Access Manager for Mobile product fix might be available to resolve your problem. About this task Procedure To find and install fixes: 1. Obtain the tools that are required to get the fix. If it is not installed, obtain your product update installer. You can download the installer from Fix Central. This site provides download, installation, and configuration instructions for the update installer. 2. Select IBM Security Access Manager for Mobile as the product, and select one or more check box that are relevant to the problem that you want to resolve. 3. Identify and select the fix that is required. 4. Download the fix. a. Open the download document and follow the link in the Download Package section. b. When downloading the file, ensure that the name of the maintenance file is not changed. This change might be intentional, or it might be an inadvertent change that is caused by certain web browsers or download utilities. 5. Apply the fix. a. Follow the instructions in the Installation Instructions section of the download document. b. For more information, see the Installing fixes with the Update Installer topic in the product documentation. 6. Optional: Subscribe to receive weekly notifications about fixes and other IBM Support updates. 42 IBM Security Access Manager for Mobile: Troubleshooting Guide

55 Contacting IBM Support IBM Support assists with product defects, answers FAQs, and helps users resolve problems with the product. Before you begin After you try to find your answer or solution by using other self-help options such as technotes, you can contact IBM Support. Before you contact IBM Support, your company or organization must have an active IBM software subscription and support contract, and you must be authorized to submit problems to IBM. For information about the types of available support, see the Support portfolio topic in the Software Support Handbook. Procedure To contact IBM Support about a problem: 1. Define the problem, gather background information, and determine the severity of the problem. For more information, see the Getting IBM support topic in the Software Support Handbook. 2. Gather diagnostic information. 3. Submit the problem to IBM Support in one of the following ways: v Using IBM Support Assistant (ISA): v Online through the IBM Support Portal: You can open, update, and view all of your service requests from the Service Request portlet on the Service Request page. v By telephone for critical, system down, or severity 1 issues: For the phone number to call in your region, see the Directory of worldwide contacts web page. Results If the problem that you submit is for a software defect or for missing or inaccurate documentation, IBM Support creates an Authorized Program Analysis Report (APAR). The APAR describes the problem in detail. Whenever possible, IBM Support provides a workaround that you can implement until the APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the IBM Support website daily, so that other users who experience the same problem can benefit from the same resolution. What to do next Exchanging information with IBM To diagnose or identify a problem, you might need to provide IBM Support with data and information from your system. In other cases, IBM Support might provide you with tools or utilities to use for problem determination. Sending information to IBM Support To reduce the time that is required to resolve your problem, you can send trace and diagnostic information to IBM Support. Appendix. Support Information 43

56 Procedure To submit diagnostic information to IBM Support: 1. Open a problem management record (PMR). 2. Collect the diagnostic data that you need. Diagnostic data helps reduce the time that it takes to resolve your PMR. You can collect the diagnostic data manually or automatically: v Collect the data manually. v Collect the data automatically. 3. Compress the files by using the.zip or.tar file format. 4. Transfer the files to IBM. You can use one of the following methods to transfer the files to IBM: v IBM Support Assistant v The Service Request tool v Standard data upload methods: FTP, HTTP v Secure data upload methods: FTPS, SFTP, HTTPS v All of these data exchange methods are explained on the IBM Support website. Receiving information from IBM Support Occasionally an IBM technical-support representative might ask you to download diagnostic tools or other files. You can use FTP to download these files. Before you begin Ensure that your IBM technical-support representative provided you with the preferred server to use for downloading the files and the exact directory and file names to access. Procedure To download files from IBM Support: 1. Use FTP to connect to the site that your IBM technical-support representative provided and log in as anonymous. Use your address as the password. 2. Change to the appropriate directory: a. Change to the /fromibm directory. cd fromibm b. Change to the directory that your IBM technical-support representative provided. cd nameofdirectory 3. Enable binary mode for your session. binary 4. Use the get command to download the file that your IBM technical-support representative specified. get filename.extension 5. End your FTP session. quit 44 IBM Security Access Manager for Mobile: Troubleshooting Guide